Related Alerts and Events Timeline View

alerts events advanced search

Certain Event Details pages include a View in Timeline option, which opens a new window with filterable tables of the alerts and events related to the selected event. The Timeline of Related Alerts & Events table displays search results in two tabs, one for Alerts and one for Events.

To view the Timeline of Related Alerts & Events, select View in Timeline from an Event Details page, or select Related Alerts & Events from an alert.

Timeline of Related Alerts & Events

Update the Search Timeframe ⫘

You can update the search window of the Timeline of Related Alerts & Events.

1. From the Timeline of Related Alerts & Events page, grab the handles of the timeline bar surrounding the Source Event and drag them to the time before or after you want to search.
2. Choose Update. Secureworks® Taegis™ XDR returns the alerts and events from that window and displays them in the table below.

Change the Timeline Window

Filter by Event Type ⫘

The Events tab view includes filters for available data types above data table. Toggle these filters to include or exclude event types from the search results table.

Data Types Filter

Timeline of Related Alerts & Events Table Actions ⫘

The table of alerts and events includes the following actions that you can take:

• Select/reorder columns
• Add and remove columns
• Export selected as CSV
• Add to Investigation
• Add to New Investigation

Timeline View Using Advanced Search Builder ⫘

The following documentation applies if you have not opted in to the Advanced Search Query Language.

Data Type Button States ⫘

Data Types show four possible states:

Active ⫘

An Active Data Type button:

• Has a solid, color-filled dot
• Indicates that the query will filter for this data type when you select Update

Inactive ⫘

An Inactive Data Type button:

• Dot has no color, with an outline only
• Indicates the query is not showing results for and will not filter for this data type when you select Update

Error ⫘

A Data Type button in the Error state:

• Has a yellow color, with an exclamation point in a triangle
• Indicates that the query has failed

Cancelled ⫘

A Data Type button in the Cancelled state:

• Has a solid, color-filled dot but with the text crossed out, indicating that the filter was selected, but was cancelled (by clicking the X in the button) during the update
• Indicates the filter is in an intermediate cancelled state

Cancelled Event Type Filter

Data Types ⫘

The following Data Types are available in the filter:

Data Types

• Alerts (ALRT)
• Auth Events (AUTH)
• Cloud Audit (CAUD)
• Command Events (CMD)
• DNS Events (DNS)
• Filemod (FILE)
• HTTP Events (HTTP)
• Inspector Process Events (INSP)
• Memory Allocation Events (MEM)
• Management Events (MGMT)
• Netflow Events (NET)
• NIDS Events (NIDS)
• Process Module Events (PMOD)
• Persistence Events (PRST)
• Process Events (PROC)
• Registry Events (REG)
• Script Block Events (SCPT)
• Thread Injection Events (THRD)

Adjustable Query Parameters for Timeline of Related Alerts and Events ⫘

• Most data types are queried with a host_id parameter to return events from the same host that started the selected process, within the period of time specified on the time slider.
• The Restrict to the Selected Process for DNS, Management (MGMT), Netflow (NET) & Persistence (PRST) check box option is selected by default and adds parameters to the queries for those event types to only return events initiated from the selected process.
• The query time range defaults to ±15 minutes from the selected process from the time slider and can be adjusted to extend to ±6 hours from the process creation timestamp.
• A selection of Data Type buttons are selected by default when the Timeline of Related Alerts & Events page initially loads, but you can easily change them and then update the filter.